Technical Change Lead

Citigroup Inc.; United States; Hybrid; USD 121,000 - 175,000; Full time

Benefits offered by this job

Generous holiday allowance

Discretional annual bonus

Private medical insurance

Pension plan

Parental leave

Learning & development resources

Job summary

Citigroup Inc. in London seeks a hands-on Technical Change Lead to drive vulnerability remediation across critical portfolios.

You will partner with engineering squads to remediate SAST defects, manage third‑party dependency upgrades, and push for containerized, rapid deployment patterns to enable same‑day hotfixes. You will guide architects, coordinate external contractor squads, and collaborate with internal tooling teams to remove friction and accelerate patching velocity while meeting audit

Qualifications

• Read code, review PRs, and engage peers to solve blockers.
• Hands-on problem solving for dependency graphs and pipelines.
• Collaborate with teams to streamline processes and reduce toil.
• Translate technical challenges into clear updates for leaders.
• Drive defect closure and rapid, secure deployments.

Responsibilities

• Remediation enablement and same-day release acceleration with teams.
• Modernize packaging, containerize workloads, and reduce patch blast radius.
• Lead workshops, refactor insecure patterns, and upgrade dependencies.
• Review remediation plans and validate technical feasibility.
• Coordinate contractor squads and ensure quality, security, and cadence.
• Improve developer tooling and self-service remediation utilities.
• Govern remediation programs with metrics on MTTR and velocity.

Skills

Technical depth & credibility

Hands-on problem solver

Empathy & collaboration

Clear communication

Execution focus

Education

Bachelor’s Degree in Computer Science, Software Engineering, IT (Master’s a plus)

Tools

SonarQube

Checkmarx

Veracode

Fortify

Snyk

Black Duck

JFrog Xray

Dependabot

Docker

Kubernetes

OpenShift

Jenkins

Tekton

Harness

GitHub Actions

Job description

The Technical Change Lead is a hands‑on, high‑impact technical leader responsible for actively driving software vulnerability remediation across designated application portfolios. This role works directly at the engineering squad and application level to help teams remediate static code vulnerabilities (SAST), patch vulnerable third‑party dependencies and frameworks (SCA), and adopt modern software delivery practices - including containerization and lightweight release mechanics - to achieve same‑day hotfix and deployment capabilities. Operating on the ground as a technical catalyst and problem solver, the Technical Change Lead partners with application leads to validate remediation plans, coordinates day‑to‑day execution with external contractor remediation squads, and works alongside internal tooling teams to eliminate developer friction and accelerate patching velocity. What you’ll do Hands‑On Remediation Enablement & Same‑Day Release Acceleration

Hands‑On Remediation Enablement & Same‑Day Release Acceleration

• Work directly with software application teams to assess their release pipelines, identify deployment bottlenecks, and implement lightweight release patterns that enable same‑day patching of critical security defects.
• Guide and coach development squads on modernizing legacy packaging and transitioning workloads into containerized runtimes (e.g., Docker, Kubernetes, OpenShift), reducing patch blast radius and enabling rapid, repeatable deployments.
• Lead practical, technical workshops and hands‑on coding/pairing sessions demonstrating how to refactor insecure code patterns and safely upgrade complex dependencies with zero downtime.

Application Plan Review & Technical Feasibility Validation

• Review, critique, and validate vulnerability remediation plans submitted by application teams, ensuring proposals address fundamental code defects and dependency debt rather than temporary workarounds.
• Evaluate technical trade‑offs involving breaking API changes in patched libraries, major framework upgrades, and compiler/runtime compatibility.
• Assist application architects in breaking down large remediation initiatives into sprint‑size, testable increments with automated regression validation.

Contractor Squad Coordination & Delivery Tracking

• Coordinate day‑to‑day technical workflows for specialized external contractor squads and staff augmentation engineers assigned to assist application teams with code fixes and dependency updates.
• Review contractor code submissions and pull requests for adherence to enterprise code quality, testing standards, and security requirements.
• Track contractor burn‑down rates, triage throughput, and verify that knowledge transfer to permanent application owners occurs seamlessly during the remediation lifecycle.

Internal Tooling Adoption & Developer Experience Optimization

• Champion the adoption of developer‑centric scanning and remediation tools directly inside engineering workflows (IDE extensions, automated dependency bump bots, localized static analysis, image scanning).
• Gather concrete feedback from developer teams regarding scanning false positives, build breaks, or pipeline delays; partner with internal tooling and developer platform teams to refine scanner configurations and deploy self‑service remediation utilities.
• Assist in rolling out centralized vulnerability tracking portals, SBOM management tools, and fast‑track change approval pathways for vulnerability patches.

Tactical Program Governance & Remediation Tracking

• Monitor and report on portfolio‑level remediation health, tracking Mean Time to Remediate (MTTR), Static Code Defect Resolution Velocity, Dependency Patch Aging, and Same‑Day Fix Readiness.
• Escalate systemic technical roadblocks, recurring architectural patterns causing vulnerabilities, and infrastructure gaps to the Program Director and relevant platform owners.
• Ensure all completed remediations possess sufficient automated testing and deployment evidence to satisfy internal audit and risk compliance criteria.

Desired Qualifications

• + Technical Depth & Credibility: Able to read code, review PRs, and engage peer‑to‑peer with lead developers and architects to solve real technical blockers.
• + Hands‑On Problem Solver: Proactively jumps into tricky dependency graphs or pipeline issues to help teams find practical paths to resolution.
• + Empathy & Collaboration: Understands sprint pressures and developer workflows; focuses on streamlining processes and removing toil rather than enforcing rigid bureaucracy.
• + Clear Communication: Translates complex technical challenges and remediation progress into crisp updates for directors and program managers.
• + Execution Focus: Driven by measurable outcomes - closing defect counts, reducing patch dwell time, and helping teams achieve same‑day deployment capabilities.

Key Performance Indicators (Success Metrics)

• Same‑Day Deployment Enablement: Number of assigned application services enabled with containerized pipelines and automated verification to release vulnerability fixes within 24 hours.
• Static Code Remediation Volume: Rate of closed static code (SAST) defects and reduction in high/critical code flaws across the assigned portfolio.
• Third‑Party Dependency MTTR: Reduction in the average dwell time of vulnerable open‑source and third‑party libraries across active repositories.
• Plan Validation Accuracy & Velocity: Turnaround time and execution success rate for application remediation plans reviewed and approved.
• Contractor Utilization & Quality: Quality scores and defect‑resolution output delivered by external contractor squads under supervision.

Qualifications

• + Bachelor's Degree in Computer Science, Software Engineering, Information Technology, or related technical field (Master's degree is a plus).
• + 7-15 years of progressive experience in software engineering, application architecture, or technical delivery leadership.
• + 3-5+ years in a lead engineer, technical architect, or technical lead role guiding engineering squads, driving code quality improvements, or managing technical debt / software remediation initiatives.
• + Demonstrated hands‑on experience refactoring software to resolve static code defects (SAST) and managing complex third‑party library/framework upgrades across multi‑tier applications.
• + Experience collaborating with and directing external contractors, vendor delivery teams, or distributed engineering resources.

Technical Proficiencies

• + Static Code Analysis & Refactoring: Practical experience interpreting SAST findings (e.g., SonarQube, Checkmarx, Veracode, Fortify) and implementing secure coding patterns in languages such as Java, Python, Go, C#/.NET, or JavaScript/TypeScript.
• + Software Dependency Management: Deep familiarity with Software Composition Analysis (SCA) tools (e.g., Snyk, Black Duck, JFrog Xray, Dependabot) and dependency management ecosystems (Maven, Gradle, npm, NuGet, pip).
• + Containerization & Cloud‑Native Delivery: Hands‑on proficiency with container technologies (Docker, OCI), container management platforms (Kubernetes, OpenShift), and container base‑image patching strategies.
• + Build Automation & Rapid Release: Experience optimizing CI/CD build pipelines (e.g., Jenkins, Tekton, Harness, GitHub Actions), automated test execution, and deployment strategies (canary, blue‑green) to facilitate hotfixes and same‑day releases.

Working at Citi is far more than just a job. A career with us means joining a team of approximately 219,000 dedicated people from around the globe. At Citi, you’ll have the opportunity to grow your career, give back to your community and make a real impact.

By joining Citi London

you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (which is annually reviewed), and enjoy a whole host of additional benefits such as:

• Generous holiday allowance starting at 27 days plus bank holidays; increasing with tenure
• A discretional annual performance related bonus
• Private medical insurance packages to suit your personal circumstances
• Employee Assistance Program
• Pension Plan
• Paid Parental Leave
• Special discounts for employees, family, and friends
• Access to an array of learning and development resources

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive.